Critical UEFI Firmware Flaw: CVE-2026-97631 Threatens Global Data Centres

Cybersecurity researchers have discovered CVE-2026-97631, a critical-severity vulnerability in the open-source TianoCore EDK II codebase used to build UEFI firmware for modern servers. The flaw has a severity score of 9.5 out of 10 and can allow remote arbitrary code execution during the boot sequence.

The vulnerability affects foundational firmware widely adopted across cloud providers, server vendors, and independent BIOS makers, including AMI, Insyde, and Phoenix, as well as Microsoft’s Project Mu fork.

What is CVE-2026-97631?

CVE-2026-97631 is a critical vulnerability in the ICMP component of the TianoCore EDK II codebase. It can allow remote arbitrary code execution during the boot sequence.

Key facts:

Who discovered it?

The vulnerability was discovered by cybersecurity researchers Alex Matrosov of Anthropic and Dan Holmes of Google.

The researchers identified the flaw in the open-source TianoCore EDK II codebase, which is used to build UEFI firmware for modern servers worldwide.

Who is affected?

The flaw affects foundational firmware widely adopted across:

• Cloud providers

• Server vendors

• Independent BIOS makers, including AMI, Insyde, and Phoenix

• Microsoft’s Project Mu fork

Because TianoCore EDK II is used to build UEFI firmware for modern servers, the potential impact spans much of the global data centre infrastructure.

What is UEFI firmware?

UEFI (Unified Extensible Firmware Interface) is the low-level firmware that initializes hardware during the boot process before the operating system loads.

UEFI firmware:

• Starts the computer or server

• Initializes hardware components

• Loads the operating system

• Provides security features like Secure Boot

• Manages system settings and diagnostics

A vulnerability in UEFI firmware is particularly dangerous because it operates below the operating system level, making it harder to detect and remediate with traditional security tools.

Why is this flaw so serious?

CVE-2026-97631 is serious for several reasons:

1. Remote code execution during boot

An attacker could potentially execute arbitrary code during the boot sequence, before the operating system and its security tools are even loaded.

2. Critical severity score

At 9.5 out of 10, this is classified as a critical vulnerability, indicating maximum potential impact.

3. Wide adoption

TianoCore EDK II is used by major BIOS vendors and cloud providers, meaning the potential blast radius is enormous.

4. Firmware-level persistence

Firmware-level attacks are extremely difficult to detect and remove, as they persist even after operating system reinstalls.

Has it been exploited?

As of disclosure, the flaw does not appear to have been exploited in the wild yet.

However, security researchers and vendors are urging organisations to patch quickly, as proof-of-concept exploits and active scanning often follow public disclosure of critical vulnerabilities.

What should organisations do?

Immediate actions

• Identify servers using TianoCore EDK II-based firmware

• Check with your server vendor for patched firmware

• Apply firmware updates as soon as they are available

• Monitor vendor advisories from AMI, Insyde, Phoenix, and Microsoft

• Review network segmentation to limit exposure

• Ensure ICMP traffic to management interfaces is restricted

Longer-term actions

• Establish a firmware patching programme

• Include firmware in vulnerability management

• Use hardware root of trust where available

• Monitor for boot-level anomalies

• Work with vendors on coordinated disclosure

• Test firmware updates in staging environments first

Vendor response

Affected vendors including AMI, Insyde, Phoenix, and Microsoft are expected to release patched firmware based on the TianoCore EDK II fix.

Organisations should monitor:

• AMI security advisories

• Insyde security advisories

• Phoenix security advisories

• Microsoft Project Mu updates

• TianoCore project announcements

Why firmware security matters more than ever

Firmware attacks are among the most dangerous because they:

• Operate below the operating system

• Persist across OS reinstalls

• Are difficult to detect with standard antivirus

• Can compromise entire server fleets

• Affect cloud infrastructure at scale

The discovery of CVE-2026-97631 highlights the need for organisations to treat firmware as a first-class security concern, not an afterthought.

Comparison with other recent firmware threats

What happens next?

• Vendors will release patched firmware

• Organisations will begin patching cycles

• Researchers may publish proof-of-concept exploits

• CISA may add the CVE to its Known Exploited Vulnerabilities catalog if exploitation begins

• Cloud providers will roll out firmware updates across their fleets

This is a developing story. Global IT Services will update this article as vendor patches and new technical details emerge.

Frequently Asked Questions

What is CVE-2026-97631?

CVE-2026-97631 is a critical vulnerability in the TianoCore EDK II codebase used to build UEFI firmware for modern servers, with a severity score of 9.5 out of 10.

How severe is CVE-2026-97631?

It is rated 9.5 out of 10 (Critical) and can allow remote arbitrary code execution during the boot sequence.

Who discovered CVE-2026-97631?

The flaw was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.

Which vendors are affected?

The flaw affects firmware built on TianoCore EDK II, used by AMI, Insyde, Phoenix, Microsoft Project Mu, and many cloud providers and server vendors.

Has CVE-2026-97631 been exploited?

As of disclosure, the flaw does not appear to have been exploited in the wild yet.

How can I protect my servers?

Identify affected firmware, apply vendor patches as soon as available, restrict ICMP traffic to management interfaces, and include firmware in your vulnerability management programme.

Sources

• Next Interrupt — Cloud and enterprise technology news: Researchers uncover severe firmware flawnextinterrupt

• TianoCore — EDK II Project

• CISA — Known Exploited Vulnerabilities Catalog

• NIST — National Vulnerability Database

• AMI — Security Advisories

• Insyde Software — Security Advisories

• Phoenix Technologies — Security Advisories

• Microsoft — Project Mu